File Upload RCE in Laravel-Mediable

Executive Summary

CVE-2026-49972 is a file upload vulnerability in Laravel-Mediable versions before 7.0.0. It allows unauthenticated attackers to achieve remote code execution (RCE) by uploading a file with a double extension, such as shell.php.jpg.

The vulnerability occurs because the system extracts the base filename (e.g., shell.php from shell.php.jpg) while performing validation checks. The outer extension (.jpg) bypasses security checks like MIME type, extension, and aggregate type validation. However, on misconfigured Apache or nginx servers that execute any filename containing .php as PHP code, the file is treated as executable, leading to RCE.

The issue stems from the PATHINFO_FILENAME extraction preserving the inner .php extension, which is not properly sanitized. The fix in version 7.0.0 introduces sanitization to replace forbidden extensions (e.g., .php) within filenames, converting shell.php.jpg to shell-php.jpg to prevent execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can perform the following checks:

• Check the version of Laravel-Mediable installed. If it is before 7.0.0, your system is vulnerable. You can verify the version by inspecting the package's metadata in your Laravel project, typically found in the `composer.lock` or `vendor` directory.
• Review file uploads in your application for files with double extensions (e.g., `shell.php.jpg`). You can search for such files using commands like:
• On Linux: `find /path/to/uploads -type f -name "*.php.*"` to locate files with nested .php extensions.
• Check your Apache or Nginx server configuration to see if it is misconfigured to execute files containing .php in their names. For Apache, look for directives like `SetHandler` or `AddType` in `.htaccess` or virtual host configurations that might allow PHP execution for non-standard extensions.
• For Nginx, inspect server blocks for `location` directives that include `fastcgi_pass` or similar PHP execution handlers applied to files with unusual extensions.
• Test file upload functionality in your application by attempting to upload a file with a double extension (e.g., `test.php.jpg`). If the file is stored with the inner .php extension intact, the system may be vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts if exploited, including:

• Remote Code Execution (RCE): Attackers can execute arbitrary code on your server, potentially gaining full control over the affected system.
• Unauthorized Access: Attackers may access sensitive data, modify or delete files, or escalate privileges within your application or server.
• System Compromise: The server could be used to launch further attacks, such as spreading malware, hosting phishing pages, or participating in botnets.
• Data Breaches: If your application handles sensitive data (e.g., user credentials, personal information), attackers could exfiltrate or manipulate this data.

The impact is particularly high if your server is misconfigured to execute files with .php extensions, even when they are embedded within other extensions (e.g., .jpg).

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can significantly impact compliance with common standards and regulations, including:

• GDPR (General Data Protection Regulation): If the vulnerability leads to a data breach involving personal data of EU citizens, your organization may face severe penalties (up to 4% of global annual revenue or €20 million, whichever is higher). GDPR requires organizations to implement appropriate technical measures to protect personal data, and this vulnerability represents a failure to do so.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), exploitation of this vulnerability could result in unauthorized access to PHI, leading to violations of the HIPAA Security Rule. This could result in fines, legal action, and reputational damage.
• PCI DSS (Payment Card Industry Data Security Standard): If your application processes payment card data, this vulnerability could lead to unauthorized access to cardholder data, violating PCI DSS requirements. Non-compliance can result in fines, increased transaction fees, or loss of the ability to process payments.
• ISO 27001: This standard requires organizations to implement controls to manage information security risks. A vulnerability like this indicates a failure to adequately protect against unauthorized code execution, which could lead to non-compliance with ISO 27001 requirements.

Exploitation of this vulnerability could also lead to breaches of contractual obligations, industry-specific regulations, or internal security policies, depending on the nature of your organization and the data it handles.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, take the following immediate steps:

• Upgrade Laravel-Mediable to version 7.0.0 or later, as this version includes the fix for the double extension bypass. You can update the package using Composer: `composer require plank/laravel-mediable:^7.0.0`.
• If upgrading is not immediately possible, apply the patch manually by modifying the `sanitizeFileName` function in `File.php` to sanitize forbidden file extensions, even when they appear as nested extensions. The patch replaces forbidden extensions (e.g., .php) with a safe alternative (e.g., `script-php.jpg`).
• Configure the `mediable.forbidden_file_extensions` setting in `config/mediable.php` to include a blacklist of executable file extensions (e.g., .php, .php5, .phtml). Ensure this list is comprehensive to block all potential executable extensions.
• Review and secure your Apache or Nginx server configuration to prevent execution of files with double extensions. For Apache, ensure that `SetHandler` or `AddType` directives are not applied to files with nested .php extensions. For Nginx, verify that `fastcgi_pass` or similar directives are not applied to such files.
• Audit your file upload directories for any existing files with double extensions (e.g., `*.php.*`) and remove or quarantine them to prevent potential exploitation.
• Implement additional validation on the server side to ensure uploaded files do not contain forbidden extensions, even as nested extensions. This can include checking the base filename for disallowed patterns.

Useful 0 Not Useful 0